[MS-IISS]:
Internet Information Services (IIS) ServiceControl Protocol
Intellectual Property Rights Notice for Open Specifications Documentation
Technical Documentation. Microsoft publishes Open Specifications documentation for protocols, file formats, languages, standards as well as overviews of the interaction among each of these technologies.
Copyrights. This documentation is covered by Microsoft copyrights. Regardless of any other terms that are contained in the terms of use for the Microsoft website that hosts this documentation, you may make copies of it in order to develop implementations of the technologies described in the Open Specifications and may distribute portions of it in your implementations using these technologies or your documentation as necessary to properly document the implementation. You may also distribute in your implementation, with or without modification, any schema, IDL's, or code samples that are included in the documentation. This permission also applies to any documents that are referenced in the Open Specifications.
No Trade Secrets. Microsoft does not claim any trade secret rights in this documentation.
Patents. Microsoft has patents that may cover your implementations of the technologies described in the Open Specifications. Neither this notice nor Microsoft's delivery of the documentation grants any licenses under those or any other Microsoft patents. However, a given Open Specification may be covered by Microsoft Open Specification Promise or the Community Promise. If you would prefer a written license, or if the technologies described in the Open Specifications are not covered by the Open Specifications Promise or Community Promise, as applicable, patent licenses are available by contacting .
Trademarks. The names of companies and products contained in this documentation may be covered by trademarks or similar intellectual property rights. This notice does not grant any licenses under those rights. For a list of Microsoft trademarks, visit
Fictitious Names. The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in this documentation are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred.
Reservation of Rights. All other rights are reserved, and this notice does not grant any rights other than specifically described above, whether by implication, estoppel, or otherwise.
Tools. The Open Specifications do not require the use of Microsoft programming tools or programming environments in order for you to develop an implementation. If you have access to Microsoft programming tools and environments you are free to take advantage of them. Certain Open Specifications are intended for use in conjunction with publicly available standard specifications and network programming art, and assumes that the reader either is familiar with the aforementioned material or has immediate access to it.
Revision Summary
Date / Revision History / Revision Class / Comments7/20/2007 / 0.1 / Major / MCPP Milestone 5 Initial Availability
9/28/2007 / 0.2 / Minor / Made a change to the IDL.
10/23/2007 / 0.2.1 / Editorial / Changed language and formatting in the technical content.
11/30/2007 / 0.2.2 / Editorial / Changed language and formatting in the technical content.
1/25/2008 / 0.2.3 / Editorial / Changed language and formatting in the technical content.
3/14/2008 / 0.2.4 / Editorial / Changed language and formatting in the technical content.
5/16/2008 / 0.2.5 / Editorial / Changed language and formatting in the technical content.
6/20/2008 / 1.0 / Major / Updated and revised the technical content.
7/25/2008 / 2.0 / Major / Updated and revised the technical content.
8/29/2008 / 2.0.1 / Editorial / Fix capitalization issues.
10/24/2008 / 2.0.2 / Editorial / Changed language and formatting in the technical content.
12/5/2008 / 3.0 / Major / Updated and revised the technical content.
1/16/2009 / 3.0.1 / Editorial / Changed language and formatting in the technical content.
2/27/2009 / 3.0.2 / Editorial / Changed language and formatting in the technical content.
4/10/2009 / 3.0.3 / Editorial / Changed language and formatting in the technical content.
5/22/2009 / 3.0.4 / Editorial / Changed language and formatting in the technical content.
7/2/2009 / 4.0 / Major / Updated and revised the technical content.
8/14/2009 / 4.0.1 / Editorial / Changed language and formatting in the technical content.
9/25/2009 / 4.1 / Minor / Clarified the meaning of the technical content.
11/6/2009 / 4.1.1 / Editorial / Changed language and formatting in the technical content.
12/18/2009 / 4.1.2 / Editorial / Changed language and formatting in the technical content.
1/29/2010 / 4.1.3 / Editorial / Changed language and formatting in the technical content.
3/12/2010 / 4.1.4 / Editorial / Changed language and formatting in the technical content.
4/23/2010 / 4.1.5 / Editorial / Changed language and formatting in the technical content.
6/4/2010 / 4.1.6 / Editorial / Changed language and formatting in the technical content.
7/16/2010 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
8/27/2010 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
10/8/2010 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
11/19/2010 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
1/7/2011 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
2/11/2011 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
3/25/2011 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
5/6/2011 / 4.1.6 / None / No changes to the meaning, language, or formatting of the technical content.
6/17/2011 / 4.2 / Minor / Clarified the meaning of the technical content.
9/23/2011 / 4.2 / None / No changes to the meaning, language, or formatting of the technical content.
12/16/2011 / 5.0 / Major / Updated and revised the technical content.
3/30/2012 / 5.0 / None / No changes to the meaning, language, or formatting of the technical content.
7/12/2012 / 5.0 / None / No changes to the meaning, language, or formatting of the technical content.
10/25/2012 / 5.0 / None / No changes to the meaning, language, or formatting of the technical content.
1/31/2013 / 5.0 / None / No changes to the meaning, language, or formatting of the technical content.
8/8/2013 / 6.0 / Major / Updated and revised the technical content.
11/14/2013 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
2/13/2014 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
5/15/2014 / 6.0 / None / No changes to the meaning, language, or formatting of the technical content.
6/30/2015 / 7.0 / Major / Significantly changed the technical content.
10/16/2015 / 7.0 / No Change / No changes to the meaning, language, or formatting of the technical content.
Table of Contents
1Introduction
1.1Glossary
1.2References
1.2.1Normative References
1.2.2Informative References
1.3Overview
1.4Relationship to Other Protocols
1.5Prerequisites/Preconditions
1.6Applicability Statement
1.7Versioning and Capability Negotiation
1.8Vendor-Extensible Fields
1.9Standards Assignments
2Messages
2.1Transport
2.2Common Data Types
2.2.1SERIALIZED_ENUM_SERVICE_STATUS
2.2.2STATUS_BLOB
3Protocol Details
3.1IIS Service Control Server Details
3.1.1Abstract Data Model
3.1.2Timers
3.1.3Initialization
3.1.4Message Processing Events and Sequencing Rules
3.1.4.1Stop (Opnum 7)
3.1.4.2Start (Opnum 8)
3.1.4.3Reboot (Opnum 9)
3.1.4.4Status (Opnum 10)
3.1.4.5Kill (Opnum 11)
3.1.5Timer Events
3.1.6Other Local Events
4Protocol Examples
4.1Status Method Call Example
5Security
5.1Security Considerations for Implementers
5.2Index of Security Parameters
6Appendix A: Full IDL
7Appendix B: Product Behavior
8Change Tracking
9Index
1Introduction
This specification defines the Internet Information Services (IIS) ServiceControl Protocol. This protocol is a client-to-server protocol which enables remote control of Internet services as a single unit. The interface can be used to start or stop these services. It also can be used to terminate the service processes or reboot the computer. Lastly, it provides status information about the services.
Sections 1.8, 2, and 3 of this specification are normative and can contain the terms MAY, SHOULD, MUST, MUST NOT, and SHOULD NOT as defined in [RFC2119]. Sections 1.5 and 1.9 are also normative but do not contain those terms. All other sections and examples in this specification are informative.
1.1Glossary
The following terms are specific to this document:
Distributed Component Object Model (DCOM): The Microsoft Component Object Model (COM) specification that defines how components communicate over networks, as specified in [MS-DCOM].
dynamic endpoint: A network-specific server address that is requested and assigned at run time. For more information, see [C706].
endpoint: A network-specific address of a remote procedure call (RPC) server process for remote procedure calls. The actual name and type of the endpoint depends on the RPC protocol sequence that is being used. For example, for RPC over TCP (RPC Protocol Sequence ncacn_ip_tcp), an endpoint might be TCP port 1025. For RPC over Server Message Block (RPC Protocol Sequence ncacn_np), an endpoint might be the name of a named pipe. For more information, see [C706].
graceful stop: Occurs when services are notified to stop and successfully complete that operation, including finishing any outstanding work, within a specified amount of time.
Interface Definition Language (IDL): The International Standards Organization (ISO) standard language for specifying the interface for remote procedure calls. For more information, see [C706] section 4.
Internet Information Services (IIS): The services provided in Windows implementation that support web server functionality. IIS consists of a collection of standard Internet protocol servers such as HTTP and FTP in addition to common infrastructures that are used by other Microsoft Internet protocol servers such as SMTP, NNTP, and so on. IIS has been part of the Windows operating system in some versions and a separate install package in others. IIS version 5.0 shipped as part of Windows 2000 operating system, IIS version 5.1 as part of Windows XP operating system, IIS version 6.0 as part of Windows Server 2003 operating system, and IIS version 7.0 as part of Windows Vista operating system and Windows Server 2008 operating system.
Internet services: A generic term used to refer to a server implementation of processes that support Internet functionality. In the Windows Server operating system implementations, this refers to a set of Windows NT services that handle protocols such as HTTP, FTP, SMTP, and others.
little-endian: Multiple-byte values that are byte-ordered with the least significant byte stored in the memory location with the lowest address.
remote procedure call (RPC): A context-dependent term commonly overloaded with three meanings. Note that much of the industry literature concerning RPC technologies uses this term interchangeably for any of the three meanings. Following are the three definitions: (*) The runtime environment providing remote procedure call facilities. The preferred usage for this meaning is "RPC runtime". (*) The pattern of request and response message exchange between two parties (typically, a client and a server). The preferred usage for this meaning is "RPC exchange". (*) A single message from an exchange as defined in the previous definition. The preferred usage for this term is "RPC message". For more information about RPC, see [C706].
RPC protocol sequence: A character string that represents a valid combination of a remote procedure call (RPC) protocol, a network layer protocol, and a transport layer protocol, as described in [C706] and [MS-RPCE].
RPC transport: The underlying network services used by the remote procedure call (RPC) runtime for communications between network nodes. For more information, see [C706] section 2.
universally unique identifier (UUID): A 128-bit value. UUIDs can be used for multiple purposes, from tagging objects with an extremely short lifetime, to reliably identifying very persistent objects in cross-process communication such as client and server interfaces, manager entry-point vectors, and RPC objects. UUIDs are highly likely to be unique. UUIDs are also known as globally unique identifiers (GUIDs) and these terms are used interchangeably in the Microsoft protocol technical documents (TDs). Interchanging the usage of these terms does not imply or require a specific algorithm or mechanism to generate the UUID. Specifically, the use of this term does not imply or require that the algorithms described in [RFC4122] or [C706] must be used for generating the UUID.
MAY, SHOULD, MUST, SHOULD NOT, MUST NOT: These terms (in all caps) are used as defined in [RFC2119]. All statements of optional behavior use either MAY, SHOULD, or SHOULD NOT.
1.2References
Links to a document in the Microsoft Open Specifications library point to the correct section in the most recently published version of the referenced document. However, because individual documents in the library are not updated at the same time, the section numbers in the documents may not match. You can confirm the correct section numbering by checking the Errata.
1.2.1Normative References
We conduct frequent surveys of the normative references to assure their continued availability. If you have any issue with finding a normative reference, please contact . We will assist you in finding the relevant information.
[C706] The Open Group, "DCE 1.1: Remote Procedure Call", C706, August 1997,
[MS-DCOM] Microsoft Corporation, "Distributed Component Object Model (DCOM) Remote Protocol".
[MS-DTYP] Microsoft Corporation, "Windows Data Types".
[MS-ERREF] Microsoft Corporation, "Windows Error Codes".
[MS-OAUT] Microsoft Corporation, "OLE Automation Protocol".
[MS-RPCE] Microsoft Corporation, "Remote Procedure Call Protocol Extensions".
[MS-SCMR] Microsoft Corporation, "Service Control Manager Remote Protocol".
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997,
1.2.2Informative References
None.
1.3Overview
The IIS ServiceControl Protocol provides a mechanism for remote control of Internet services as a single unit on a server. Through the IIS ServiceControl Protocol, a client can start or stop the services. The client can also terminate processes hosting the Internet services functionality or reboot the computer. Lastly, the client can also retrieve status about the services.
The IIS ServiceControl Protocol is expressed as a set of DCOM interfaces. The server end of the protocol implements support for the DCOM interface to manage the Internet services. The client end of the protocol invokes method calls on the interface to control the services on the server. The DCOM calls use standard DCOM marshaling.
1.4Relationship to Other Protocols
This protocol depends on the remote protocol described in [MS-DCOM].
1.5Prerequisites/Preconditions
This protocol requires that the DCOM protocol MUST be implemented on both the client and server computers.
This protocol is implemented over DCOM and RPC and, as a result, has the prerequisites identified in [MS-DCOM] and [MS-RPCE] as being common to DCOM and RPC interfaces.
This protocol specification assumes that any security or authentication associations between the client and server are performed by the DCOM layer.
1.6Applicability Statement
The IIS ServiceControl Protocol is applicable to remote control Internet services on a server as a single unit.
1.7Versioning and Capability Negotiation
None.
1.8Vendor-Extensible Fields
This protocol uses HRESULT values, as specified in [MS-ERREF]. Vendors can define their own HRESULT values, provided they set the C bit (0x20000000) for each vendor-defined value, indicating that the value is a customer code.
1.9Standards Assignments
Parameter / Value / ReferenceRPC interface UUID for IIS ServiceControl Protocol / E8FB8620-588F-11D2-9D61-00C04F79C5FE / None
COM class UUID for IIS ServiceControl Protocol / E8FB8621-588F-11D2-9D61-00C04F79C5FE / None
2Messages
2.1Transport
This protocol uses the DCOM protocol, as specified in [MS-DCOM], as its transport. On its behalf, the DCOM protocol uses the following RPC protocol sequence: RPC over TCP, as specified in [MS-RPCE].
This protocol uses RPC dynamic endpoints as specified in [C706] part 4.
To access an interface, the client requests a DCOM connection to its object UUID endpoint on the server, as specified in the Standards Assignments section.
The RPC version number for all interfaces is 0.0.
An implementation of the IIS ServiceControl Protocol SHOULD<1> configure its DCOM implementation or underlying RPC transport with the RPC_C_AUTHN_LEVEL_PKT_PRIVACY authentication flags to restrict client connections. See [C706] and [MS-RPCE] for more information on the meaning of this flag.
The IIS ServiceControl Protocol uses the underlying DCOM security framework (as specified in [MS-DCOM]) for access control. DCOM differentiates between launch and access. An implementation of the IIS ServiceControl Protocol MAY differentiate between launch and access permission, and impose different authorization requirements.<2>
2.2Common Data Types
This protocol MUST indicate to the RPC runtime that it is to include support for both the NDR20 and NDR64 transfer syntaxes as well as provide the negotiation mechanism for determining which transfer syntax will be used, as specified in [MS-RPCE] section 3.
In addition to RPC base types and definitions specified in [C706] and [MS-DTYP], additional data types are defined as follows.
2.2.1SERIALIZED_ENUM_SERVICE_STATUS
This data structure provides information about the state of the Internet services on a server. It is used by the server to return data to the client in the Status method, as specified in section 3.1.4.4.
The values in this structure MUST be present in little-endian format.
0 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 10 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 2
0 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 3
0 / 1
iServiceName
iDisplayName
ServiceStatus (28 bytes)
...
...
iServiceName (4 bytes): The number of unsigned wide characters to use as an offset to the WCHAR string that contains the service name for this service. For more information, see section 2.2.2.
iDisplayName (4 bytes): The number of unsigned wide characters to use as an offset to the WCHAR string that contains the display name for this service. For more information, see section 2.2.2.
ServiceStatus (28 bytes): Provides status for the service, as specified in [MS-SCMR] section 2.2.47.
2.2.2STATUS_BLOB
The STATUS_BLOB structure is marshaled to the client using the Status method over RPC using an unsigned char array. It is up to the client or user code, and not the RPC proxy, to interpret this data correctly. The following is a description of the data structure that will be found in this array.
This structure contains an array of SERIALIZED_ENUM_SERVICE_STATUS objects, as specified in section 2.2.1, which MUST be followed by a set of null-terminated WCHAR strings.
There MUST be exactly one SERIALIZED_ENUM_SERVICE_STATUS and two null-terminated WCHAR strings for each service that is being reported.
This structure is used in the Status method, as specified in section 3.1.4.4.
The values in this field MUST be present in little-endian format.
0 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 10 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 2
0 / 1 / 2 / 3 / 4 / 5 / 6 / 7 / 8 / 9 / 3
0 / 1
SERIALIZED_ENUM_SERVICE_STATUS_ARRAY (variable)
...
SERIALIZED_ENUM_SERVICE_STATUS_INFO (variable)
...
SERIALIZED_ENUM_SERVICE_STATUS_ARRAY (variable): An array of SERIALIZED_ENUM_SERVICE_STATUS structures, as specified in section 2.2.1. This array MUST be of length pdwNumServices, as specified in section 3.1.4.4.
SERIALIZED_ENUM_SERVICE_STATUS_INFO (variable): A set of null-terminated character strings. For each SERIALIZED_ENUM_SERVICE_STATUS structure contained in SERIALIZED_ENUM_SERVICE_STATUS_ARRAY, there MUST be one string containing the service name and one string containing a display name. These strings MUST be present at the offset indicated in the associated SERIALIZED_ENUM_SERVICE_STATUS_ARRAY array.